What are the permissions required to generate and download a CSV?

Security
, ,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch 2.5 on AWS / Chrome

Describe the issue:
We have a limited read-only role set up for most of the users of our OpenSearch domain. These users are given permission to log into the dashboard via the opensearch_dashboards_user role. These users, however, can not generate and download a CSV via the Reporting tab that appears when they open a saved search. What are the permissions required to grant these users the ability to do this? I’ve tried all of the following:

cluster:admin/opendistro/reports/definition/create
cluster:admin/opendistro/reports/definition/update
cluster:admin/opendistro/reports/definition/on_demand
cluster:admin/opendistro/reports/definition/delete
cluster:admin/opendistro/reports/definition/get
cluster:admin/opendistro/reports/definition/list
cluster:admin/opendistro/reports/instance/list
cluster:admin/opendistro/reports/instance/get
cluster:admin/opendistro/reports/menu/download

Configuration:
The limited-user role for these users has the read cluster permission group.

Relevant Logs or Screenshots:

Screenshot 2023-09-22 at 12.09.22 PM

2

Hi @jamie_coursemojo

Could you share your OpenSearch logs? Have you tried to use the reports_read_access role?

3

Also, please have a look at the following topic:

1 Like
4

I don’t have that role in my instance (I am running a managed instance via AWS), but I do have reports_instances_read_access. That said, that role has 3 permissions in it, and I have already tried those in my other role:

  • cluster:admin/opendistro/reports/instance/list
  • cluster:admin/opendistro/reports/instance/get
  • cluster:admin/opendistro/reports/menu/download

I am not seeing anything in the error logs.

5

The solution in that topic worked! Thank you so much.

1 Like